[Authenticate] should check req.Items for session first

+ reverted unintended change in [Authenticate]