prevent NPE if session does not exist