why is this needed? let's just record all the events and decide later on if the session is valid