Don't disclose user sessions unless DEBUG is set.