Session out of service layer; users created in tests as needed

Follow up with Chris on this one.