Drive out SessionsController

These specs still need some serious refactoring to DRY them out.