freeze session, cookie.next after header sent