Only flush session when it is an authenticated user without REMOTE_USER