changed to ":null_session" to avoid authentication errors