Makes sense to me now... I think things are ok as they are then.

Perhaps it's best not to bother having a test for the LogicException case then. For the RepositoryException case also, to me it looks quite hard to reach as the session is only returned by a successful login. Perhaps there is a path somewhere, but I'm not sure if it's really necessary.