user, session controller tests