Prevent NRE's in empty sessions when asserting required roles/permissions