CLC-4140, final set of tests on SessionsController

https://jira.ets.berkeley.edu/jira/browse/CLC-4140

I believe we have full coverage on #lookup. For example, LTI user session with invalid user_id.