fix(session.auth): do not fatal error on unsafe auth