do not create http session is no need; prevent duplicate JSESSIONID