update to /api/session