fix login with an existing session cookie, RT#25533