updated POST /session