keep session attribute thread-safe