Use defer to unlock in session.go