What if the session was not properly created? There should be a redirect for that with an alert