look for auth_token in http header
initial implementation of sessions new controller
create session destroy controller file (empty)