fix for session fixation