almost done with session controller specs