Only configure and start session if not already started

Database/PostgreSQL.sql

@@ -25,9 +25,7 @@ CREATE TABLE IF NOT EXISTS "users_confirmations" (
 	"token" VARCHAR(255) NOT NULL,
 	"expires" INTEGER NOT NULL CHECK ("expires" >= 0)
 );
-
 CREATE INDEX IF NOT EXISTS "email_expires" ON "users_confirmations" ("email", "expires");
-
 CREATE INDEX IF NOT EXISTS "user_id" ON "users_confirmations" ("user_id");
 
 CREATE TABLE IF NOT EXISTS "users_remembered" (
@@ -37,7 +35,6 @@ CREATE TABLE IF NOT EXISTS "users_remembered" (
 	"token" VARCHAR(255) NOT NULL,
 	"expires" INTEGER NOT NULL CHECK ("expires" >= 0)
 );
-
 CREATE INDEX IF NOT EXISTS "user" ON "users_remembered" ("user");
 
 CREATE TABLE IF NOT EXISTS "users_resets" (
@@ -47,7 +44,6 @@ CREATE TABLE IF NOT EXISTS "users_resets" (
 	"token" VARCHAR(255) NOT NULL,
 	"expires" INTEGER NOT NULL CHECK ("expires" >= 0)
 );
-
 CREATE INDEX IF NOT EXISTS "user_expires" ON "users_resets" ("user", "expires");
 
 CREATE TABLE IF NOT EXISTS "users_throttling" (
@@ -56,7 +52,6 @@ CREATE TABLE IF NOT EXISTS "users_throttling" (
 	"replenished_at" INTEGER NOT NULL CHECK ("replenished_at" >= 0),
 	"expires_at" INTEGER NOT NULL CHECK ("expires_at" >= 0)
 );
-
 CREATE INDEX IF NOT EXISTS "expires_at" ON "users_throttling" ("expires_at");
 
 COMMIT;

src/Auth.php

@@ -48,7 +48,7 @@ final class Auth extends UserManager {
 		$this->sessionResyncInterval = isset($sessionResyncInterval) ? ((int) $sessionResyncInterval) : (60 * 5);
 		$this->rememberCookieName = self::createRememberCookieName();
 
-		$this->initSession();
+		$this->initSessionIfNecessary();
 		$this->enhanceHttpSecurity();
 
 		$this->processRememberDirective();
@@ -56,7 +56,8 @@ final class Auth extends UserManager {
 	}
 
 	/** Initializes the session and sets the correct configuration */
-	private function initSession() {
+	private function initSessionIfNecessary() {
+		if (\session_status() === \PHP_SESSION_NONE) {
 			// use cookies to store session IDs
 			\ini_set('session.use_cookies', 1);
 			// use cookies only (do not send session IDs in URLs)
@@ -67,6 +68,7 @@ final class Auth extends UserManager {
 			// start the session (requests a cookie to be written on the client)
 			@Session::start();
 		}
+	}
 
 	/** Improves the application's security over HTTP(S) by setting specific headers */
 	private function enhanceHttpSecurity() {