Protect from forgery with a null session