added sessions controller and moved callback from api auth into the controller