change sessions controller to confirm username