A dropped user structure could still be accessed from sessions
which were authenticated with this user.

Check that a user is dropped when accessing it from the authenticated
session.