added sessions controller and user authentication