Sessions hash ok (but not secure)