move session routes to own file