remove sessions from routes and app controller