added session generation and ensure_session