add fix for session fixation