rack.session should be a hash