implemented session protection