spec test for sessions controller