Test sessions controller on wrong credentials correctly.