session resets when user hits confirmation page