Great example! However, I noticed that the Session.login().then function called from the UsersCtrl doesn't recieve a response object. I believe since the Session.login().then in the Sessions factory gets called first, it gets the response and doesn't send it to the additional .then() in the UsersCtrl.
This causes the login logic defined in UsersCtrl to think it failed, when in fact it succeeded.