session: move session handling code