pretty sure there's still a session created after calling update