add validations for AR relations to user model
refactor sessions controller to use shoulda matcher set_session