transmit session over HTTPS