specs on omniauth session create