Refactor sessions spec to use login_xml builder