changed protect forgery to null session