somewhere somehow we should limit the maximum number of session we accept also