* changed #create spec with invalid creds to expect a  301

* implemented specs for #destroy
* implemented tests for sessions#create

* changed test params to include a :user key