maybe use session.get('account') instead?