rspec'd sessions controller