specs to protect sessions controller new action