session controller rspec test and implementation