use session correctly