add session security