Unit tests for SessionController.

Are you sure you found all usages of `params` that existed prior to this white list method?