Add failing scenario

Signin must be is tracked when signing with SessionsController#create
and *must not* be tracked when making token-authenticated request.

See #51