session: fix api coverity warnings