fix sessionId generation and validation