use JSON.parse instead of eval and update session data, fix #3