add login logic in sessions controller