Closes #3382977 by first checking if the current request has a session. This is a backport of the fix for the 4.x branch.