Add invalid data tests for session controller