rspec for sessions controller, with omniauth mocks and with TODOs