added /session endpoint