Good, you can also add an assertion that the session's user_id is _not_ set.