fix session routes and controller