modularizing to keep session key hidden did not work