It seems this never worked, it was comparing a string received from the client
with a number from the session.