improve request tests - make sure session token is not set for sessionless request
add update test