Fix in session leak and use of security model in the encounter listing script