application fixed: headers sent after session modifications