added sign_out, refactored into controllers and models