ensure sessions are properly saved even when there's an exception thrown in denyaccess or xsrffail