security: fix crash on destroy null session