add parameter to disable session for stuff like REST apis which don't need it