bugfix: redirect need session