fix #4, User and sessions controller