Move session verification to the after login flow and make it mandatory.