fix session security issue