updated user and session controllers