Followup r91270: didn't need to be so paranoid about $_SESSION, and actually was...