Empty session for request forgery protection