[1.7.x] Fixed #23939 -- Moved session verification out of middleware.

Thanks andrewbadr for the report.