test/security: check session update