fix: move sessions to user-specific temp dir (#178)