main: Fix up session protection.

This "feature" creates spurious cookies for anonymous users. Not cool and not
cacheable.