sessions allowed on non secure protocol too