make sure session is not NULL