add access denied test to login feature
add coverage dir to .gitignore
add logout test to session spec