[Security] fixed session creation on login (closes #7011)