spec for sessions_controller