fix session security bug