protect the session a little better