Make login_from session return nil instead of false

This method is not in public API, it's protected, but should
behave consistently anyway.