Added spec to test session-based authentication