fixed up session creation logic, added GET