full spec for the SessionsController