If you don't set up sessions for users working with wget, curl, etc., you'll also lock out a lot of legitimate users who want a scriptable interface to your sit

If you don't set up sessions for users working with wget, curl, etc., you'll also lock out a lot of legitimate users who want a scriptable interface to your site. This goes double if you don't offer any sort of official API. Refusing to initialize a session for non-browser UAs just invites abuse via agent masking by malicious users, while locking out innocuous and acceptable uses by your real users.