application session must be unique