Extract session endpoints into separate app