Add test for session stealing bug
Ensure $SESSION is unset before the route is executed

Workaround for session stealing bug (see session-stealing.t)