various form and session related fixes in backend