require session on root