fix session overwrite protection

fix: check if session doesn't exist