handle wrong session key