update controller specs sessions, add create & destroy