userSession can be undefined and it's being forced as present nowadays

[willianba]

I discovered that the session check is validate due to the presence or not of the cookie.
But since the user can be absent from the db, we'll fail all requests that are based on it