session function should return the XMLHTTPRequest