test/security: check session destroy