See #2564 for more background. Basically, if you want to avoid the session starting, there are a few things you should be aware of, including flash messages and security. I think these should be summarized into a short entry.