session empty obj restrict on server