made sessions controller (untested)