test for session token in delete user