Fix session creation for every user

This fixes a wrong behavior in the strong protection. Now the
session protection is only tested if a session exists and
nothing is added to the session during the process.
Only one test is impacted and has been updated.