Fix auth type selection.
RSpec matchers for HTTP status codes seem incomplete (no be_unauthorized, at least). Create a helper with all the codes and use it everywhere.
Respond with 401 instead of 403.

Also massively cleanup sessions_controller_spec and add some custom matchers.
DRY up sessions_controller_spec even more.
Move http_status_helper to matchers.