session handler (closes #4005)