The master doesn't need any authentication

Also includes a minor bug fix: Check whether the Session-variable is
set.