fix session and redirect