Only check the session key if the user is logged in, otherwise it becomes impossible to submit the login form when the session key is invalid (required for some future changes)