spec user and session specs