Testing for Exposed Session Variables