Session out of service layer; users created in tests as needed

Should return user with consent modified, then update session