don't invalidate a non-authenticated session, closes #185