hooking up a SessionController. setting up policies for authenticated users and admins