Changed test for session, make it independent of storage of session;
Added test with CSRF