oops: Don't log or email the clear text user+pass
Merge remote branch 'upstream/develop-next' into develop-next
session: Properly track new sessions

ee91d179d364b5e1348946c9af33d79a84a01787 introduced a slightly different
tracking system for detecting sessions. Instead of completely disabling the
session system for AJAX and cron requests, it detects if the session is new
or not based on the session_id() and existing data in the session backend.

However, the patch did not correctly determine if a session was new.
Instead, it flagged all session as existing. This patch fixes the detection
of existing session data so that AJAX and cron requests can operate without
writing session data to the backend.