Fix a bug and only deny new session requests when creds are present.