add SessionsController, sessions routes