factored out session module