fixed last whitelisting
add session control