Fixed #23939 -- Moved session verification out of SessionAuthenticationMiddleware.

Would it be helpful to add a brief note here about why the functionality was moved? Or is our general approach on such things these days that people can follow `git blame` to a ticket if they need to know the reason for a change?