If backend authentication fails, wait until session has created router_client_session before reading the session->router_session pointer value. There should only be one case where this situation occurs : when session is being initialized concurrently with authentication. Only consequence is to close router_client_session immediately after session initialization is completed.