add sessions controller, test for signin path
rocket through chap8: sign-in, sign-out