[FIX] core: ensure we create a new session for each tour

The browser itself would get mostly cleaned up between tours, but the
session object would not get cleaned, and apparently in some cases
that could lead to an incoherent session: a tour would add data to the
session which the next tour (logging in as a different user) would
not (fully) override, leading to a session inconsistency and a Session
Expired exception during the tour.

Fix by not storing the session on the test object, the session is
created during authentication then set on the opener & browser.