fix: session is not a dict, use .keys()