Test for session key directly on request object