users can now submit sessions (if they know the url) re #3