smarter /session endpoint