factor out ApiResponse
factor out WebSession