add more tests to confirm that actions cannot be performed on sessions of other users