move session stuff into separate package