add sessions controller - new, create, destroy - and specs