redirecting if unauthorized state; returning createdAt on user#update and session#create controller actions