invalidating session of request is forbidden