Actually this is not needed to manually start the session since the CsrfProvider will do it for us. This was the only reason behind session start. Session is mandatory here.