only allow a single session