working version of /api/get/session