have to manually deserialize when finding session