Add a call to /session/status in the loadtest

Fixes #645.  The loadtest doesn't do any password-reset stuff so I don't think we need to try to sequeeze `/password/forgot/status` in there.  @jbonacci r? but also note that we shouldn't merge this until after the new API endpoints are live.