removed gem...weird csrf bug
add sessions controller