add auth routes
session controller added