Handling protect_from_forgery with null session.