Don't reuse existing session

This is against the OCS specifications and exposes this interface to CSRF attacks.