Add test for session expiry