Don't touch the session in the test

This is a better way to test logging in/logging out since it
doesn't let the tests know about how you implement the functionality