session, base respone

- change access code to private
- add session to base response