Fix session creation for every user

This fixes a wrong behavior in the strong protection. Now the
session protection is only tested if a session exists and
nothing is added to the session during the process.
Only one test is impacted and has been updated.

Fixes #179 and #156 
Changing to `if sess is not None` breaks some tests because then when the session not None but is empty `ident != sess.get('_id', None)` triggers.

Here we want to test both if the session is not None and if the session is empty (see comment it code above the test, which I did not change):
> if the sess is empty, it's an anonymous user or just logged out
> so we can skip this

Creating a session when there is no need is precisely what this PR is about.