use device.id and not session