bp.route('/session', methods=['POST'])
nothing calls this directly
no outgoing calls
no test coverage detected