Fix #328: Move `session` to `box`