Test /api/sessions; fix supertest tests