add sessions controller and appropriate tests