user: don't reference the session_id if we don't even know if we're logged in