Updating the leaking-user test to reproduce a problem I'd found earlier.

Per Yanick's request, constructing a simulation of an issue I ran into when using the current release of this module in a live Catalyst-based application. 

Changes made include using two different `$mech` objects (to simulate two separate but simultaneous sessions), and having the /leaking_users action display the Twitter ID of the currently authenticated user.

Please disregard the first two no-op change-chunks in basic-app.t; not sure how those got in there.