prevent reflected XSS in session return parameter

encode the session parameter to prevent reflected cross site scripting
(XSS)