In some cases there might be a $_SESSION variable set even though the controller gets called with $session_started = false.