added session. removed set_canvas_request since it had been merged into validate_signed_request