tests for session api auth