Web client allows to “sign in” when authentication is disabled

When authentication is disabled, user can still visit the sign in page and enter any credentials. The app then switches to a signed in mode. When user then clicks the log out button, they will see an `HTTP 500` error due to:

```
session_destroy(): Trying to destroy uninitialized session
```