tests: add req.session.populated tests