GPII-245: removed a confusing needValidSession flag. There's now only one needSession flag that can be either undefined, 'none', 'valid' or 'lazy'.