return 401 from SessionsController#create given invalid credentials and add test testing the returned status codes