add limited session hijacking protection