core: if there is no session-id and the session is optional, then don't check for a session.