fix session vulnerability