Change !session to !session?.user to properly detect unauthenticated state. useSession() returns an object, not null.