ability to filter session and test by status, add_metadata, add_user

I prefer set_session_user. It is more explicit and does not collide with future auth APIs...