Stop creating an empty session on first request

src/pretix/helpers/safedownload.py

@@ -4,6 +4,8 @@ from django.core.signing import BadSignature, TimestampSigner
 
 
 def get_token(request, answer):
+    if not request.session.session_key:
+        request.session.create()
     payload = '{}:{}'.format(request.session.session_key, answer.pk)
     signer = TimestampSigner()
     return signer.sign(hashlib.sha1(payload.encode()).hexdigest())