Session tracks the user agent in the session, to add some detection of stolen session IDs. However this was causing a session to always be created, even if this request didnt store any data in the session.