session: when a new empty session is created, a possible existing session with the same name gets overwritten

it should return an error instead, even if the session is not locked