Wt

If a session comes in, that is NOT detected as a bot, and does allow JavaScript, they should never have a wtd parameter attached to them.
This can only be the case if JavaScript is disabled.

In the wild we've seen this happen, with suspected bots that are JS/Ajax capable, but still seemingly are only used to access a page singularly, not utilizing the session.
These type of sessions should be killed early, so they do not uselessly take up memory.