encryption in session class still needs fixing