Testing session expiration behaviour