[Security] fixed session creation when none is needed (closes #6917)