[FIX] website_sale: don't assert, just check

If the session is unbound before a call to this route, this assertion
will raise. The point of this code is not to crash when the parameters
are incorrect or the session unbound - the point is to avoid leaking
incorrect information.

Simply return an empty object to the JS code, it will stop polling after
a single failed attempt instead of crashing.

closes odoo/odoo#36356

Signed-off-by: Damien Bouvy (dbo) <dbo@odoo.com>