using Session variables instead of db