So when we login we want to create a session if there's no session created. When we do session restricted requests/messages we require session to be valid, for example specific to a user token.