For the session endpoint and sub-endpoints, we should probably use explicit views and urls instead of the generic viewsets...