Cleaned up SessionNewAction spec.

Also added reminder comments to `SessionsController` showing (most of)
the controller code that uses the new `DSO2` DSOs.

RSpec: 904 examples, 0 failures
RuboCop: 229 files inspected, no offenses detected