sessions code in app_session.js