automatically handle expired sessions
use helpers instead of locals