simpler session deserializer