Refactor SessionsController test

This change is already merged, but I wanted to add some notes explaining some of the changes I made. Once my notes have been reviewed, this PR can be closed.
Here I added two new variables for the expectations of the calls to the various `users` endpoints since all tests are going to have expectations for those calls. However, since the various tests will have different responses to those calls, I don't set the response here, but instead only create the expectation. Then in each test the expectations can be configured to respond appropriately. This is mostly to help DRY things.