session now merges during deserialization