session: fix locking bug