user & session controller tests (solution refactor)