moved response.render after session update, slower but likely to fix #44