use list instead of set to fix session serialization problem