Using IsDefined()

I have a web app that deals with both authenticated users (who log in via a central login) and unauthenticated ones.

For the authenticated ones, I call a web service that returns an XML file.  I'm using this code:

<cfif IsDefined("session.loginauth")>

    <cfset session.logincreds = XMLParse(session.loginauth)>

        <cfset session.userid = session.logincreds.user.row[1].user_id.XmlText>

        <cfset session.rights = session.logincreds.user.row[1].user_type.XmlText>

        <cfset session.usernm =  session.logincreds.user.row[1].name_first.XmlText & " " & session.logincreds.user.row[1].name_last.XmlText>

</cfif>

It works fine for authenticated users, but fails for unauthenticated ones.  The error is on the line with the XMLParse().  It's like the IsDefined isn't working and the code within the cfif is firing no matter what.

I've tried cfparam'ing that session variable like this:

<cfparam name="session.loginauth" default="">

Then:

<cfif session.loginauth neq "">

But that's no better.

Why on earth is that cfif always executing?  If I dump session.loginauth when a user's not logged in, I get nothing.