now able to return encrypted string as part of session