remove session fixation

this needs to be handled but need to find a way that works