There's no security issue here - the session_hash just needs to be set to *something*