session hijacking must be below enable sessions