raise 400 for bad cookie
generic session view
test session getter requires login
simpler test_user
test session deleter 401s if not logged in
separation between base and rest test bases