session is stored before sending response!