Do not touch _SESSION until successful