fix(session): security