Fix session creation for every user

This fixes a wrong behavior in the strong protection. Now the
session protection is only tested if a session exists and
nothing is added to the session during the process.
Only one test is impacted and has been updated.

Fixes #179 and #156 
I think you want to assert the session is `None`, e.g. `self.assertIsNone(session)`.