session[:session_id] should always return an id

Accessing `session[:session_id]` should create a new session if needed
so it always returns a session id. `session.exists?` should be used to
determine if a persisted session exists.