(Almost) Setup POST /session
* change superagent to supertest (unrelated)
* setup spec
* authenticate user & check if passwords match