public is a problem here, SessionManager is exposed to everyone (unauthed users)