fix: redirect with no session