[fix] Also expose the `session` object on the response