`$session` may be `null` if there is no session at all. Always check `$session !== null`