Bugfix: if there's no session, getCookieSessionId() cannot return a session...

Bugfix: if there's no session, getCookieSessionId() cannot return a session identifier, therefore there's no session we can return. This resolves #256.

lib/SimpleSAML/Session.php

@@ -215,6 +215,9 @@ class SimpleSAML_Session
         if ($sessionId === null) {
             $checkToken = true;
             $sessionId = $sh->getCookieSessionId();
+            if ($sessionId === null) {
+                return null;
+            }
         } else {
             $checkToken = false;
         }