fix course/css/sessionhijacking