add rack-protection and session var