Test /sessions (including /login and /logout)