add specs for sessions controller