bug where an empty session key gets you everything