bugfix: session key