rip out auto-save of session in favor of user doing explicit session.save()