I don't see an associated change to the `SessionsController`. Is this backfilling a test? I'm wondering if this should be removed in this PR and wrapped in an object or other scheme like http://www.elabs.se/blog/52-simple-authorization-in-ruby-on-rails-apps in a separate PR.