refactors sessions#create
beefs up session controller specs