Session should never have been passed by value.