fix: headers sent after session modifications