session :off from Rails 2.2 "backported" (for 2.3 and 3+)