proper use of session variables