Enforce mandatory session verification only for new logins.