add tests around the redirect with session