vps/views: get_session_user() may return None, handle gracefully