May return as authorized even if session isn't populated

If the session store load fails, it may just call fn() with no parameters.  In this case handshake.session is set to undefined and next(null, true) is still called, indicating to socket.io that the session is authorized.

This changes things to call next(err, false) if the session store doesn't pass something in session.

This case happens when MemoryStore tries to receive a non-existent session.