proper session locking