This is as opposed to a session not existing at all, in which case it would let the request pass through