made secure params private in sessions