[development] Security Question about session handling