needs sessions to be enabled