added session hijacking