fixes #137: remember me broken after lazy load change

I had to think this through several times to make sure, but I believe in the situation where the remember me cookie is present and the session cookie is not the session protection should be skipped, since there is no previous `_id` to compare against.

It seems a test for this feature did not exist and was added along with the lazy load feature. Unfortunately the logic in the test was reversed, the test expected the `session_protection` signal to fire and it did, causing the session and the remember me cookie to be deleted.

Let me know if you have any questions.