add some tests for user and session controller