add a few more failing tests to users and sessions controller