considering that session.hash expires