null session when CSRF not present/valid. Allows external access to API