The credientials might not always be in the session, if they are using the cookie auth helper to update credentials (which is a valid config option). Use authorization extract credentials instead.