session hash method is no longer private