[Security] fixed session creation when none is needed (closes #6917)
merged branch fabpot/avoid-session-creation (PR #6964)

This PR was merged into the 2.1 branch.

Commits
-------

8ca00c5 [Security] fixed session creation when none is needed (closes #6917)

Discussion
----------

[Security] fixed session creation when none is needed (closes #6917)

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #6917
| License       | MIT
| Doc PR        | n/a

---------------------------------------------------------------------------

by drak at 2013-02-04T16:24:49Z

That looks good. Maybe we need a test for this logic to prevent any regression in the future?

---------------------------------------------------------------------------

by bendavies at 2013-02-04T16:30:38Z

Yep, this was exactly what i tried locally, but really wasn't familiar enough with it to be confident enough to submit it as a fix.

Works for me!

---------------------------------------------------------------------------

by bendavies at 2013-02-04T17:19:32Z

A few test failures which were added by the breaking PR #2414 in the first place.

---------------------------------------------------------------------------

by fabpot at 2013-02-04T18:00:31Z

I've fixed the tests which now really test that the session is not started.