Can you explain the use case and the behaviour for the "needSession" parameter relative to "needValidSession"? Under what condition may a handler require a session but not a valid one?