allow session protection in session