refactor http session logic