All sessions have a state. For several types of ServerSessions, the state never gets updated to ‘authenticated’ when the session is authenticated. Clearly, that’s not a flag that we use much, but it’s probably good to be consistent.