upgrade to session locking