[5.2] Improvements for SessionGuard methods loginUsingId and onceUsingId

[vlakoff]

Follow-up to #12999.

• Remove redundant session set, as I explained in this message.
• If loginUsingId didn't find user, don't try to login and return false, instead of producing a load of errors. Note how well it is consistent with onceUsingId.
• Improve test coverage.

[taylorotwell]

Thanks.

[vlakoff]

For consistency, maybe both loginUsingId and onceUsingId should return user instance in 5.3?

[vlakoff]

Refs #8836 which fixed onceUsingId for missing user case, but not loginUsingId.

[vlakoff]

Refs #13434 which has unified loginUsingId and onceUsingId return values in 5.3, per my above comment.