sanitize the session return value to prevent xss injection