Add explicit login, logout and whoami tests.

Also fetch session document after successful auth.
Update login logic.

So that the session/get document is assigned to req.login.
Fix all docs reference.