add SessionsController, tests