uses session data