Sessions are now stored in a cookie (signed and Base-64 encoded). Form_spam_protection stores form_keys in the session. Make sure spambots implement both cookies and javascript, by storing hashed (with salt) keys in the session.