session hijacking methods, fixes