fix: protect internal session variables against user overwrite

fix: protect internal session variables against user overwrite #13000