Session: validate authenticatable presence explicitly

[EugZol]

It is required when config.load_defaults 5.2 is absent from application.rb. Otherwise, when entering email for non-existent user this code from session_controller.rb works incorrectly:

def create
  session = build_passwordless_session(find_authenticatable)

  if session.save
    Mailer.magic_link(session).deliver_now
  end

  render
end

save actually returns true and Mailer.magic_link(nil) is called.

[mikker]

Thank you for finding and reporting this! Should we add a test for It? With that I’ll be happy to merge.