testing the limit of user authentication sessions