write missing session controller spec ;-(