adding session and uuid vars to prevent refresh cheating