session: add flag to disable session lookup