session: transform() should accept const session, since it doesn't modify it