add deps & session requirement to package.js