DELETE method on session should not create a new session

The DELETE method on the session endpoint is used to end a session, so we only need to invalidate the session if there is currently an active session.