Session: Changed $response to be protected