added test unauthenticated user cannot create a session