add sessions tests, fix bug with unconfirmed user auth