According to the spec, if one logs in to REST with user B while a session is active with user A, the result should be a 409.

Verify that it works as expected, and if not, fix it.