session is only retrieved once from the session store per request