A fix and a test case for gh-530 - assertion failed

A dropped user structure could still be accessed from sessions
which were authenticated with this user.

Check that a user is dropped when accessing it from the authenticated
session.