added warning about insecure session handling