don't query api for existence of falsy session id