Do not verify identity cookie when processing required actions

[pedroigor]

Closes #17539

• Only check if the user is logged in when requests have the authentication session cookie set. When set, it indicates the authentication is still happening.
• Missing test coverage when there is no authentication session cookie but the identity cookie is still valid and maps to an existing user session. In this case, the server should continue with the required action without complaining about "user logged in" as there is no authentication/action yet happening.