modified user and sessions controller