security quick patch

global session variables cleared correctly