protect from forgery with null session