[BACKLOG-400] only allow get and set of white listed session variables