skipping authorize function in the sessions controller