protect from forgery with null session (default)