Session stealing? - Better Auth