protect reserved fields in session