Fixed session scopes so people can only see their session