* fix: avoid double bcrypt on login by adding create_session_trusted * fix: update test to expect create_session_trusted instead of create_session
* fix: avoid double bcrypt on login by adding create_session_trusted * fix: update test to expect create_session_trusted instead of create_session