CLC-4140, proper test coverage on SessionsController 

https://jira.ets.berkeley.edu/jira/browse/CLC-4140

I believe we have full coverage on #lookup. For example, LTI user session with invalid user_id.