moved session construction to common.php