diff --git a/third_party/drupal-7.95/includes/bootstrap.inc b/third_party/drupal-7.95-original/includes/bootstrap.inc
index 4f7a8f6..980ad35 100644
--- a/third_party/drupal-7.95/includes/bootstrap.inc
+++ b/third_party/drupal-7.95/includes/bootstrap.inc
@@ -696,14 +696,14 @@ function drupal_environment_initialize() {
   ini_set('magic_quotes_runtime', '0');
   // Use session cookies, not transparent sessions that puts the session id in
   // the query string.
-  ini_set('session.use_cookies', '1');
-  ini_set('session.use_only_cookies', '1');
-  ini_set('session.use_trans_sid', '0');
+  // ini_set('session.use_cookies', '1');
+  // ini_set('session.use_only_cookies', '1');
+  // ini_set('session.use_trans_sid', '0');
   // Don't send HTTP headers using PHP's session handler.
   // An empty string is used here to disable the cache limiter.
-  ini_set('session.cache_limiter', '');
+  // ini_set('session.cache_limiter', '');
   // Use httponly session cookies.
-  ini_set('session.cookie_httponly', '1');
+  // ini_set('session.cookie_httponly', '1');
 
   // Set sane locale settings, to ensure consistent string, dates, times and
   // numbers handling.
@@ -801,14 +801,14 @@ function drupal_settings_initialize() {
     $session_name = $cookie_domain;
   }
   else {
-    // Otherwise use $base_url as session name, without the protocol
-    // to use the same session identifiers across HTTP and HTTPS.
-    list( , $session_name) = explode('://', $base_url, 2);
-    // HTTP_HOST can be modified by a visitor, but we already sanitized it
-    // in drupal_settings_initialize().
-    if (!empty($_SERVER['HTTP_HOST'])) {
-      $cookie_domain = _drupal_get_cookie_domain($_SERVER['HTTP_HOST']);
-    }
+    // // Otherwise use $base_url as session name, without the protocol
+    // // to use the same session identifiers across HTTP and HTTPS.
+    // list( , $session_name) = explode('://', $base_url, 2);
+    // // HTTP_HOST can be modified by a visitor, but we already sanitized it
+    // // in drupal_settings_initialize().
+    // if (!empty($_SERVER['HTTP_HOST'])) {
+    //   $cookie_domain = _drupal_get_cookie_domain($_SERVER['HTTP_HOST']);
+    // }
 
     // Drupal 7.83 included a security improvement whereby www. is no longer
     // stripped from the cookie domain. However, this can cause problems with
diff --git a/third_party/drupal-7.95/sites/default/files/.htaccess b/third_party/drupal-7.95/sites/default/files/.htaccess
new file mode 100644
--- /dev/null
+++ b/third_party/drupal-7.95/sites/default/files/.htaccess
@@ -0,0 +1,16 @@
+# Turn off all options we don't need.
+Options None
+Options +FollowSymLinks
+
+# Set the catch-all handler to prevent scripts from being executed.
+SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
+<Files *>
+  # Override the handler again if we're run later in the evaluation list.
+  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
+</Files>
+
+# If we know how to do it safely, disable the PHP engine entirely.
+<IfModule mod_php5.c>
+  php_flag engine off
+</IfModule>
+