Add tests for users and sessions

Split out common test infrastructure from security_templates_test, make
tests HTTPS, use the http.Client provided by httptest

internal/handlers/sessions.go

@@ -8,6 +8,7 @@ import (
 	"io"
 	"log"
 	"net/http"
+	"strings"
 	"time"
 )
 
@@ -22,6 +23,11 @@ func (s *Session) Write(w http.ResponseWriter) error {
 	return enc.Encode(s)
 }
 
+func (s *Session) Read(json_str string) error {
+	dec := json.NewDecoder(strings.NewReader(json_str))
+	return dec.Decode(s)
+}
+
 func GetSession(db *DB, r *http.Request) (*Session, error) {
 	var s Session