User-agent: *
Disallow: /session # not for the public