fixes #21, adds back session restrictions