changed protect from forgery from exception to reset session