create sessions endpoint for authentication