Fixed session auth a bit to invalidate on lookup() not found.