fix bug on missing decoding where getting session from auth