session security fix