Fixed #21608 -- by providing a test case and adopting the existing patch

The provided patch changed the behaviour of session.save() by strictly differentiating between creating new and updating existing sessions.
Since this broke some existing tests that relied on the implicit creation, the TestClient now provides a createSession() helper.
Is this line needed? I wonder if it's better to raise an error if you try and use sessions without it installed.