Fixed NPE when closing session that never authenticated.

git-svn-id: http://svn.igniterealtime.org/svn/repos/openfire/trunk@8523 b35dd754-fafc-0310-a699-88a17e54d16e

src/java/org/jivesoftware/openfire/SessionManager.java

@@ -12,6 +12,7 @@
 package org.jivesoftware.openfire;
 
 import org.jivesoftware.openfire.audit.AuditStreamIDFactory;
+import org.jivesoftware.openfire.auth.AuthToken;
 import org.jivesoftware.openfire.auth.UnauthorizedException;
 import org.jivesoftware.openfire.component.InternalComponentManager;
 import org.jivesoftware.openfire.container.BasicModule;
@@ -915,7 +916,9 @@ public class SessionManager extends BasicModule {
             return false;
         }
 
-        boolean anonymous = session.getAuthToken().isAnonymous();
+        AuthToken authToken = session.getAuthToken();
+        // Consider session anonymous (for this matter) if we are closing a session that never authenticated
+        boolean anonymous = authToken == null || authToken.isAnonymous();
         return removeSession(session, session.getAddress(), anonymous, false);
     }