add session option to protection, fixes #601