removed session key from webapp