'session' is now 'box.session'