Fatal error when session expires on login to Admin CP

[Drek282]

Login method should automatically create new session without producing an error when session has expired.

[Rosenstein]

After session expires, page refresh redirects back to normal login form, user logs in again but is redirected back to login form with Your session has expired banner displayed.
Second login is then required from the user.
The bug happens only when CSRF protection is enabled.

The goal is to have Your session has expired shown on first page load/refresh after the session has expired.

Spoiler

_{Don't use `root` , kids!} 😅