update: added allowed resource herokuapp api url, pluralized the sessions return json