more secure sessions, now pass tests, thanks André Kablu