Simplify by removing possibility for reps to sign in using external_id
Add spec for sessions controller