Define clear semantics for get_session_…() variants

• Which of them fail?
• Which create new sessions?
• Which require a user to be logged in?