moved session handling to database