not exactly sure whether sending HTTP errors should be the responsibility of a session factory.