set session variable in signed_request.rb