fixing bug where .save() included session values