Avoid session lookup when ID is nil

[EiNSTeiN-]

During a request when the session is accessed, load_session will call find_session which ends up calling get_session_model. When no session cookie is present in the browser, the id will be nil. Adding id && in this PR avoids an unnecessary database query that would look like:

SELECT `sessions`.* FROM `sessions` WHERE `sessions`.`session_id` IS NULL LIMIT 1

arguably, if this matched a row, that would be a bug.