More robust error handling.
Do not leak expected session id to client.