See the code comment. This situation can happen after registration, where it would be harmless to do a session reset. And it can happen if policies are not acknowledged at the time of a login, in which case we really to reset it after the policies are acknowledged.
Depends on D12388