un-hardcode the session id