WebSession: refresh user detail only in Shibboleth

• If a user does not re-authenticate within one hour websession was reloading fresh information from Shibboleth, assuming this was well available over any HTTPS request. This is no longer the case. So a new check is performed to refresh user data only if Shibboleth is indeed loaded (otherwise empty external groups and user settings were replacing valid ones).