tests for bad sessionIds in generateToken #11