bugfix: redirect should pass session (0)