use sessions for HTTP reqs