_should_force_authn: handle non-existing session