Fixed #23939 -- Moved session verification out of SessionAuthenticationMiddleware.