Added the *new* SessionNewAction DSO.

The controller action `SessionsController#new` doesn't do much; in
typical Rails-controller fashion, it's a place to hang the
`sessions/new` view from (which in a typical Rails controller/view
interaction, would expect the controller to initialise a new, empty
record for the view to populate).

We've also updated `UserRepository#guest_user` to set a dummy password
*in the `test` environment only*. That *might* get pulled back out
later.

RSpec: 928 examples, 0 failures (but see Issue #87)
RuboCop: 224 files inspected, no offenses detected