sessions controller spec happy path