gistfile1.diff

diff --git a/core/HTTP.php b/core/HTTP.php
index 0ce1a49..dd08567 100644
--- a/core/HTTP.php
+++ b/core/HTTP.php
@@ -346,7 +346,7 @@ class HTTP {
 			$responseHeaders["Cache-Control"] = "max-age=" . self::$cache_age . ", must-revalidate";
 			$responseHeaders["Pragma"] = "";
 		} else {
-			$responseHeaders["Cache-Control"] = "no-cache, max-age=0, must-revalidate";
+			$responseHeaders['Vary'] = 'Cookie';
 		}
 
 		if(self::$modification_date && self::$cache_age > 0) {
diff --git a/core/Session.php b/core/Session.php
index 1125184..7cdf5a4 100644
--- a/core/Session.php
+++ b/core/Session.php
@@ -371,7 +371,12 @@ class Session {
 	 * Only save the changes, so that anyone manipulating $_SESSION directly doesn't get burned.
 	 */ 
 	public function inst_save() {
-		$this->recursivelyApply($this->changedData, $_SESSION);
+		if($this->changedData) {
+			if(!isset($_SESSION)) {
+				Session::start();
+			}
+			$this->recursivelyApply($this->changedData, $_SESSION);
+		}
 	}
 	
 	/**
diff --git a/core/control/Director.php b/core/control/Director.php
index 3a8bb40..a33322f 100755
--- a/core/control/Director.php
+++ b/core/control/Director.php
@@ -119,6 +119,9 @@ class Director {
 		if(isset($_SERVER['HTTP_REFERER'])) $req->addHeader("Referer", $_SERVER['HTTP_REFERER']);
 
 		// Load the session into the controller
+
+		if(!isset($_SESSION) && isset($_COOKIE['PHPSESSID'])) Session::start();
+
 		$session = new Session(isset($_SESSION) ? $_SESSION : null);
 		
 		$result = Director::handleRequest($req, $session);
diff --git a/main.php b/main.php
index 85de63a..24fcf03 100644
--- a/main.php
+++ b/main.php
@@ -65,8 +65,6 @@ if (function_exists('mb_http_output')) {
 	mb_internal_encoding('UTF-8');
 }
 
-Session::start();
-
 // IIS will sometimes generate this.
 if(!empty($_SERVER['HTTP_X_ORIGINAL_URL'])) {
 	$_SERVER['REQUEST_URI'] = $_SERVER['HTTP_X_ORIGINAL_URL'];

I noticed that this will of course not prevent setting a session when having a comment form, due to the CSRF protection in Form.php

Yes, stojg, that's true, but there are two workarounds:

• Disable CSRF on the comment form.
• Require users to click something before the comment form is loaded. It could be on a separate page or loaded via an ajax request.

Similar rules apply for things like having a log-in form in the corner of the screen. However, for a log-in form there's probably not too much risk in having CSRF disabled, because an attacker would need to know the user's username & password to actually do anything nasty.