switching to session attr and fixing some attack bugs
adding feedback to escape