testing server side session, not session in the request header