use empty string instead of None for no session key