bugfix: don't crash on invalid session