session start without security code works...