controllers specs: sessions