refactored sessions controller