because OC_User::login will create a new session we shall only try to login if user and pass are set

ensure to never destroy an existing session