add tests for sessions and authentication