Removed forgery protection from session create