ensure sessions still work when there is an XSRF or auth failure