Make session handling also recognise logged-out response