pass session key to new routes