session.js: correct parenthesization in 2 places