session retrieves users from map of id/password pairs to users; adds missing tests