change protect from forgery to null_session