Some changes in unit tests
A session is not a user, so put "Session" in string dump
Do not throw ForbiddenException, use security implementation instead