don't return invalid session from AtmosphereRequest#getSession