diff --git a/server/commons/Handler.coffee b/server/commons/Handler.coffee
index 9dfca705b..bd4bf9750 100644
--- a/server/commons/Handler.coffee
+++ b/server/commons/Handler.coffee
@@ -47,7 +47,7 @@ module.exports = class Handler
 
   # sending functions
   sendUnauthorizedError: (res) -> errors.forbidden(res) #TODO: rename sendUnauthorizedError to sendForbiddenError
-  sendNotFoundError: (res) -> errors.notFound(res)
+  sendNotFoundError: (res, message) -> errors.notFound(res, message)
   sendMethodNotAllowed: (res) -> errors.badMethod(res)
   sendBadInputError: (res, message) -> errors.badInput(res, message)
   sendDatabaseError: (res, err) ->
diff --git a/server/plugins/plugins.coffee b/server/plugins/plugins.coffee
index 114294ed8..7d7911ae2 100644
--- a/server/plugins/plugins.coffee
+++ b/server/plugins/plugins.coffee
@@ -31,8 +31,7 @@ module.exports.NamedPlugin = (schema) ->
   schema.index({'slug': 1}, {unique: true, sparse: true, name: 'slug index'})
 
   schema.statics.getBySlug = (slug, done) ->
-    @findOne {slug: slug}, (err, doc) ->
-      if err then done err else done doc
+    @findOne {slug: slug}, done
 
   schema.pre('save', (next) ->
     if schema.uses_coco_versions
diff --git a/server/users/user_handler.coffee b/server/users/user_handler.coffee
index 5b4241c92..a92a432ca 100644
--- a/server/users/user_handler.coffee
+++ b/server/users/user_handler.coffee
@@ -240,13 +240,13 @@ UserHandler = class UserHandler extends Handler
       @sendSuccess(res, documents)
 
   IDify: (idOrSlug, done) ->
-    if Handler.isID idOrSlug
-      done idOrSlug
-    else
-      User.getBySlug idOrSlug, (user) -> done user?.get '_id'
+    return done null, idOrSlug if Handler.isID idOrSlug
+    User.getBySlug idOrSlug, (err, user) -> done err, user?.get '_id'
 
   getLevelSessions: (req, res, userIDOrSlug) ->
-    @IDify userIDOrSlug, (userID) =>
+    @IDify userIDOrSlug, (err, userID) =>
+      return @sendDatabaseError res, err if err
+      return @sendNotFoundError res unless userID?
       query = creator: userID + ''
       isAuthorized = req.user._id+'' is userID or req.user.isAdmin()
       projection = {}
@@ -261,7 +261,9 @@ UserHandler = class UserHandler extends Handler
         @sendSuccess(res, documents)
 
   getEarnedAchievements: (req, res, userIDOrSlug) ->
-    @IDify userIDOrSlug, (userID) =>
+    @IDify userIDOrSlug, (err, userID) =>
+      return @sendDatabaseError res, err if err
+      return @sendNotFoundError res unless userID?
       query = user: userID + ''
       query.notified = false if req.query.notified is 'false'
       EarnedAchievement.find(query).sort(changed: -1).exec (err, documents) =>
diff --git a/test/server/functional/level_session.spec.coffee b/test/server/functional/level_session.spec.coffee
index ba0265cf0..eddb3407c 100644
--- a/test/server/functional/level_session.spec.coffee
+++ b/test/server/functional/level_session.spec.coffee
@@ -1,12 +1,64 @@
 require '../common'
 
-describe 'LevelFeedback', ->
+describe '/db/level.session', ->
 
-  url = getURL('/db/level.session')
+  url = getURL('/db/level.session/')
+  session =
+    permissions: simplePermissions
 
   it 'get schema', (done) ->
-    request.get {uri: url+'/schema'}, (err, res, body) ->
+    request.get {uri: url+'schema'}, (err, res, body) ->
       expect(res.statusCode).toBe(200)
       body = JSON.parse(body)
       expect(body.type).toBeDefined()
       done()
+
+  it 'clears things first', (done) ->
+    clearModels [LevelSession], (err) ->
+      expect(err).toBeNull()
+      done()
+
+  # TODO Tried to mimic what happens on the site. Why is this even so hard to do.
+  # Right now it's even possible to create ownerless sessions through POST
+  xit 'allows users to create level sessions through PATCH', (done) ->
+    loginJoe (joe) ->
+      console.log url + mongoose.Types.ObjectId()
+      request {method: 'patch', uri: url + mongoose.Types.ObjectId(), json: session}, (err, res, body) ->
+        expect(err).toBeNull()
+        expect(res.statusCode).toBe 200
+        console.log body
+        expect(body.creator).toEqual joe.get('_id').toHexString()
+        done()
+
+  # Should remove this as soon as the PATCH test case above works
+  it 'create a level session', (done) ->
+    unittest.getNormalJoe (joe) ->
+      session.creator = joe.get('_id').toHexString()
+      session = new LevelSession session
+      session.save (err) ->
+        expect(err).toBeNull()
+        done()
+
+  it 'GET /db/user/<ID>/level.sessions gets a user\'s level sessions', (done) ->
+    unittest.getNormalJoe (joe) ->
+      request.get {uri: getURL "/db/user/#{joe.get '_id'}/level.sessions"}, (err, res, body) ->
+        expect(err).toBeNull()
+        expect(res.statusCode).toBe 200
+        sessions = JSON.parse body
+        expect(sessions.length).toBe 1
+        done()
+
+  it 'GET /db/user/<SLUG>/level.sessions gets a user\'s level sessions', (done) ->
+    unittest.getNormalJoe (joe) ->
+      request.get {uri: getURL "/db/user/#{joe.get 'slug'}/level.sessions"}, (err, res, body) ->
+        expect(err).toBeNull()
+        expect(res.statusCode).toBe 200
+        sessions = JSON.parse body
+        expect(sessions.length).toBe 1
+        done()
+
+  it 'GET /db/user/<IDorSLUG>/level.sessions returns 404 if user not found', (done) ->
+    request.get {uri: getURL "/db/user/misterschtroumpf/level.sessions"}, (err, res) ->
+      expect(err).toBeNull()
+      expect(res.statusCode).toBe 404
+      done()