protect from forgery with null session
remove root elements from json collection responses