user and session controller's tests