fixed bug where embedded applications would deserialize sessions twice