use bbs session instead of pw