added TODOs, replaced raw access by session wrapper