session :off from Rails 2.2 "backported" (for 3+ and 2.3)