Why does removing line of code produce "undefined method `errors' for nil:NilClass" in simple_form

I'm attempting to role out my own authentication system for a Rails app. I keep getting the "undefined method `errors' for nil:NilClass" error when trying to load my login page. If I take out the following code, it works fine but I'm curious as to why that is? Should the code be kept instead of deleting it?

<%= f.error_notification message: f.object.errors[:base].to_sentence if f.object.errors[:base].present? %>

Here's everything else I have:

controllers/sessions/new.html.erb

<%= simple_form_for(:session, url: login_path) do |f| %>
  <%= f.error_notification %>
  <%= f.error_notification message: f.object.errors[:base].to_sentence if f.object.errors[:base].present? %>

  <div class="">
    <%= f.input :email %>
    <%= f.input :password, label: "Password" %>
  </div>

  <div class="form-actions">
    <%= f.button :submit %>
  </div>
<% end %>

controllers/users_controller.rb

  before_action :set_user, only: %i[ show edit update destroy ]

  # GET /users or /users.json
  def index
    @users = User.all
  end

  # GET /users/1 or /users/1.json
  def show
  end

  # GET /users/new
  def new
    @user = User.new
  end

  # GET /users/1/edit
  def edit
  end

  # POST /users or /users.json
  def create
    @user = User.new(user_params)
    if @user.save
      session[:user_id] = @user.id
    else
      redirect_to root_path
    end

    respond_to do |format|
      if @user.save
        format.html { redirect_to @user, notice: "User was successfully created." }
        format.json { render :show, status: :created, location: @user }
      else
        format.html { render :new, status: :unprocessable_entity }
        format.json { render json: @user.errors, status: :unprocessable_entity }
      end
    end
  end

  private
    # Use callbacks to share common setup or constraints between actions.
    def set_user
      @user = User.find(params[:id])
    end

    # Only allow a list of trusted parameters through.
    def user_params
      params.require(:user).permit(:first_name, :last_name, :email, :password)
    end
end

routes.rb

Rails.application.routes.draw do
  resources :users
  
  get 'login' => 'sessions#new'
  post 'login' => 'sessions#create'
  delete 'logout' => 'sessions#destroy'

  root 'main#index'
end

Your session object wasn't instantiated anywhere, you are passing a string.

<%= simple_form_for(:session, ...) %>

For f.object.errors to work something like an ActiveRecord / ActiveModel instance should have been passed.