ShieldSquare engine is fine-tuned in such way that it processes the data which has a session value in the API, else the site must not send session value at all.