1) Yeah, is very dangerous, they had to fix that checking that $var != undefined && $var != NULL(@phalcon).
2) When some user logs in, the developer has to set some way (DB, access file) to say that the user is already log on. So I don't think so that will happen normally.