webgoat session was being stored under inconsistent keys in session
fixed by using constant names SESSION on WebSession