fix a bug in session protection logic that still created a session for anonymous users