fix server
fix session handling
some of the tests fixed, not all
fix tests

now, the pool can create sessioned_user or user based on whether a password is set or not