Neither of these two changes seem to address `$_SESSION isn't always defined`. There are still accesses to `$_SESSION`.