Fixed #23939 -- Moved session verification out of SessionAuthenticationMiddleware.

A sentence wouldn't hurt.