Remove SessionManager.session auth checks

This breaks traversal.
Check if auth matches current session

This blocks abuse of the _eu_session cookie.