[Security] fixed session creation on login (closes #7011)

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #7011
| License       | MIT
| Doc PR        | n/a

I fixed the test with UsernamePasswordToken (should start the session) and added a new test without token (should not start session).