bug fix: user can cancel past sessions