better explanation of how session can be null