Refact auth/session relation and involved tests