fix a bug when using session by a unknown user