test: verify exempt-user session persistence via Session model, not dashboard view

The dashboard-view GET added to test_single_session_exempt_user passed
locally but failed in CI's shared-with-cms-1 job (400 instead of 200),
likely from unrelated view-layer state (MFE redirect flags, site config)
picked up when run alongside the rest of that shard. Assert against
Session.objects directly instead -- that's the actual mechanism
set_login_session uses to evict a session, so it verifies the same
thing without depending on the dashboard view rendering successfully.