better hijacker session handling