Fix session checking code

https://bugzilla.mozilla.org/show_bug.cgi?id=1099007
actually, could and must O_o the && is not shortcut what `!req.session.user` is true, so it'll then check `req.session.user.username` and throw.