Add user validation spec
Add users and session controllers and routes