fixed session fixation bug