If the user doesnt have a refresh token, dont fail to find a session