is set: this insures that uninitialized msg-scan ptrs/cfg won't be
written to disk unless a successful logon()/getmsgptrs() was called first.
This probably fixes the sighting that echicken reported where a failed
SSH login caused his sub-scan config file (data/user/0001.subs) to contain
uninitialized/garbage values.
logout() could be called from multiple places (e.g. JS and Baja modules),
even before a successful login is completed, so this sighting is not
entirely impractical.