DRY out login_user code in before()
test for error, when no Cookie-Header was set during logout
remove empty "beforeEach", until it will be used
fix status code of User.session() ( was 400, is 403 )