tests: session mocked
token: bind it to session id [closes #8]