Do not remove non-hupa session attributes, so as hupa server can be included in other backends, and some re-factoring to avoid repeated code