fixed session faking