factor out WebSession