disable session stuff if we are doing http auth