Session out of service layer; users created in tests as needed

Should just user getSession()? It can throw 412 if the user hasn't consented... can't it?