Add checks to prevent session manipulation when during session_protection

* if anonymous and session_protection is off, exit early
* if no '_id' is specified, don't set one.
  no '_id' is same as incorrect ID and should trigger session protection.
  instead of setting a new ID