diff --git a/src/proto_http.c b/src/proto_http.c
index 7825d5c..1cb3063 100644
--- a/src/proto_http.c
+++ b/src/proto_http.c
@@ -2876,7 +2876,7 @@
 
 		/* Check if we want to fail this monitor request or not */
 		list_for_each_entry(cond, &sess->fe->mon_fail_cond, list) {
-			int ret = acl_exec_cond(cond, sess->fe, s, SMP_OPT_DIR_REQ|SMP_OPT_FINAL);
+			int ret = acl_exec_cond(cond, sess->fe, sess, s, SMP_OPT_DIR_REQ|SMP_OPT_FINAL);
 
 			ret = acl_pass(ret);
 			if (cond->pol == ACL_COND_UNLESS)
@@ -3103,6 +3103,7 @@
 {
 	struct stats_admin_rule *stats_admin_rule;
 	struct stream_interface *si = &s->si[1];
+	struct session *sess = s->sess;
 	struct http_txn *txn = s->txn;
 	struct http_msg *msg = &txn->req;
 	struct uri_auth *uri_auth = s->be->uri_auth;
@@ -3197,7 +3198,7 @@
 		int ret = 1;
 
 		if (stats_admin_rule->cond) {
-			ret = acl_exec_cond(stats_admin_rule->cond, s->be, s, SMP_OPT_DIR_REQ|SMP_OPT_FINAL);
+			ret = acl_exec_cond(stats_admin_rule->cond, s->be, sess, s, SMP_OPT_DIR_REQ|SMP_OPT_FINAL);
 			ret = acl_pass(ret);
 			if (stats_admin_rule->cond->pol == ACL_COND_UNLESS)
 				ret = !ret;
@@ -3353,7 +3354,7 @@
 		if (rule->cond) {
 			int ret;
 
-			ret = acl_exec_cond(rule->cond, px, s, SMP_OPT_DIR_REQ|SMP_OPT_FINAL);
+			ret = acl_exec_cond(rule->cond, px, sess, s, SMP_OPT_DIR_REQ|SMP_OPT_FINAL);
 			ret = acl_pass(ret);
 
 			if (rule->cond->pol == ACL_COND_UNLESS)
@@ -3566,7 +3567,7 @@
 				void *ptr;
 
 				t = rule->act_prm.trk_ctr.table.t;
-				key = stktable_fetch_key(t, s->be, s, SMP_OPT_DIR_REQ | SMP_OPT_FINAL, rule->act_prm.trk_ctr.expr, NULL);
+				key = stktable_fetch_key(t, s->be, sess, s, SMP_OPT_DIR_REQ | SMP_OPT_FINAL, rule->act_prm.trk_ctr.expr, NULL);
 
 				if (key && (ts = stktable_get_entry(t, key))) {
 					stream_track_stkctr(&s->stkctr[http_req_trk_idx(rule->action)], t, ts);
@@ -3629,7 +3630,7 @@
 		if (rule->cond) {
 			int ret;
 
-			ret = acl_exec_cond(rule->cond, px, s, SMP_OPT_DIR_RES|SMP_OPT_FINAL);
+			ret = acl_exec_cond(rule->cond, px, sess, s, SMP_OPT_DIR_RES|SMP_OPT_FINAL);
 			ret = acl_pass(ret);
 
 			if (rule->cond->pol == ACL_COND_UNLESS)
@@ -4171,7 +4172,7 @@
 	/* add request headers from the rule sets in the same order */
 	list_for_each_entry(wl, &px->req_add, list) {
 		if (wl->cond) {
-			int ret = acl_exec_cond(wl->cond, px, s, SMP_OPT_DIR_REQ|SMP_OPT_FINAL);
+			int ret = acl_exec_cond(wl->cond, px, sess, s, SMP_OPT_DIR_REQ|SMP_OPT_FINAL);
 			ret = acl_pass(ret);
 			if (((struct acl_cond *)wl->cond)->pol == ACL_COND_UNLESS)
 				ret = !ret;
@@ -4209,7 +4210,7 @@
 		if (rule->cond) {
 			int ret;
 
-			ret = acl_exec_cond(rule->cond, px, s, SMP_OPT_DIR_REQ|SMP_OPT_FINAL);
+			ret = acl_exec_cond(rule->cond, px, sess, s, SMP_OPT_DIR_REQ|SMP_OPT_FINAL);
 			ret = acl_pass(ret);
 			if (rule->cond->pol == ACL_COND_UNLESS)
 				ret = !ret;
@@ -6396,7 +6397,7 @@
 			if (txn->status < 200 && txn->status != 101)
 				break;
 			if (wl->cond) {
-				int ret = acl_exec_cond(wl->cond, px, s, SMP_OPT_DIR_RES|SMP_OPT_FINAL);
+				int ret = acl_exec_cond(wl->cond, px, sess, s, SMP_OPT_DIR_RES|SMP_OPT_FINAL);
 				ret = acl_pass(ret);
 				if (((struct acl_cond *)wl->cond)->pol == ACL_COND_UNLESS)
 					ret = !ret;
@@ -7153,6 +7154,7 @@
  */
 int apply_filters_to_request(struct stream *s, struct channel *req, struct proxy *px)
 {
+	struct session *sess = s->sess;
 	struct http_txn *txn = s->txn;
 	struct hdr_exp *exp;
 
@@ -7177,7 +7179,7 @@
 		 * next filter if the condition does not match.
 		 */
 		if (exp->cond) {
-			ret = acl_exec_cond(exp->cond, px, s, SMP_OPT_DIR_REQ|SMP_OPT_FINAL);
+			ret = acl_exec_cond(exp->cond, px, sess, s, SMP_OPT_DIR_REQ|SMP_OPT_FINAL);
 			ret = acl_pass(ret);
 			if (((struct acl_cond *)exp->cond)->pol == ACL_COND_UNLESS)
 				ret = !ret;
@@ -7977,6 +7979,7 @@
  */
 int apply_filters_to_response(struct stream *s, struct channel *rtr, struct proxy *px)
 {
+	struct session *sess = s->sess;
 	struct http_txn *txn = s->txn;
 	struct hdr_exp *exp;
 
@@ -8003,7 +8006,7 @@
 		 * next filter if the condition does not match.
 		 */
 		if (exp->cond) {
-			ret = acl_exec_cond(exp->cond, px, s, SMP_OPT_DIR_RES|SMP_OPT_FINAL);
+			ret = acl_exec_cond(exp->cond, px, sess, s, SMP_OPT_DIR_RES|SMP_OPT_FINAL);
 			ret = acl_pass(ret);
 			if (((struct acl_cond *)exp->cond)->pol == ACL_COND_UNLESS)
 				ret = !ret;
@@ -9908,8 +9911,8 @@
 smp_prefetch_http(struct proxy *px, struct stream *s, unsigned int opt,
                   const struct arg *args, struct sample *smp, int req_vol)
 {
-	struct http_txn *txn = s->txn;
-	struct http_msg *msg = &txn->req;
+	struct http_txn *txn;
+	struct http_msg *msg;
 
 	/* Note: this function may only be used from places where
 	 * http_init_txn() has already been done, and implies that <s>,
@@ -9917,8 +9920,13 @@
 	 * against an eventual mistake in the fetch capability matrix.
 	 */
 
-	if (unlikely(!s || !txn))
+	if (!s)
+		return 0;
+	txn = s->txn;
+
+	if (!txn)
 		return 0;
+	msg = &txn->req;
 
 	/* Check for a dependency on a request */
 	smp->type = SMP_T_BOOL;
@@ -10036,7 +10044,7 @@
  * This is intended to be used with pat_match_meth() only.
  */
 static int
-smp_fetch_meth(struct proxy *px, struct stream *strm, unsigned int opt,
+smp_fetch_meth(struct proxy *px, struct session *sess, struct stream *strm, unsigned int opt,
                const struct arg *args, struct sample *smp, const char *kw, void *private)
 {
 	int meth;
@@ -10090,7 +10098,7 @@
 }
 
 static int
-smp_fetch_rqver(struct proxy *px, struct stream *strm, unsigned int opt,
+smp_fetch_rqver(struct proxy *px, struct session *sess, struct stream *strm, unsigned int opt,
                 const struct arg *args, struct sample *smp, const char *kw, void *private)
 {
 	struct http_txn *txn = strm->txn;
@@ -10115,7 +10123,7 @@
 }
 
 static int
-smp_fetch_stver(struct proxy *px, struct stream *strm, unsigned int opt,
+smp_fetch_stver(struct proxy *px, struct session *sess, struct stream *strm, unsigned int opt,
                 const struct arg *args, struct sample *smp, const char *kw, void *private)
 {
 	struct http_txn *txn;
@@ -10145,7 +10153,7 @@
 
 /* 3. Check on Status Code. We manipulate integers here. */
 static int
-smp_fetch_stcode(struct proxy *px, struct stream *strm, unsigned int opt,
+smp_fetch_stcode(struct proxy *px, struct session *sess, struct stream *strm, unsigned int opt,
                  const struct arg *args, struct sample *smp, const char *kw, void *private)
 {
 	struct http_txn *txn;
@@ -10169,7 +10177,7 @@
 
 /* 4. Check on URL/URI. A pointer to the URI is stored. */
 static int
-smp_fetch_url(struct proxy *px, struct stream *strm, unsigned int opt,
+smp_fetch_url(struct proxy *px, struct session *sess, struct stream *strm, unsigned int opt,
               const struct arg *args, struct sample *smp, const char *kw, void *private)
 {
 	struct http_txn *txn;
@@ -10185,7 +10193,7 @@
 }
 
 static int
-smp_fetch_url_ip(struct proxy *px, struct stream *strm, unsigned int opt,
+smp_fetch_url_ip(struct proxy *px, struct session *sess, struct stream *strm, unsigned int opt,
                  const struct arg *args, struct sample *smp, const char *kw, void *private)
 {
 	struct http_txn *txn;
@@ -10205,7 +10213,7 @@
 }
 
 static int
-smp_fetch_url_port(struct proxy *px, struct stream *strm, unsigned int opt,
+smp_fetch_url_port(struct proxy *px, struct session *sess, struct stream *strm, unsigned int opt,
                    const struct arg *args, struct sample *smp, const char *kw, void *private)
 {
 	struct http_txn *txn;
@@ -10232,7 +10240,7 @@
  * returns full lines instead (useful for User-Agent or Date for example).
  */
 static int
-smp_fetch_fhdr(struct proxy *px, struct stream *strm, unsigned int opt,
+smp_fetch_fhdr(struct proxy *px, struct session *sess, struct stream *strm, unsigned int opt,
                const struct arg *args, struct sample *smp, const char *kw, void *private)
 {
 	struct hdr_idx *idx;
@@ -10290,7 +10298,7 @@
  * returns full lines instead (useful for User-Agent or Date for example).
  */
 static int
-smp_fetch_fhdr_cnt(struct proxy *px, struct stream *strm, unsigned int opt,
+smp_fetch_fhdr_cnt(struct proxy *px, struct session *sess, struct stream *strm, unsigned int opt,
                    const struct arg *args, struct sample *smp, const char *kw, void *private)
 {
 	struct hdr_idx *idx;
@@ -10322,7 +10330,7 @@
 }
 
 static int
-smp_fetch_hdr_names(struct proxy *px, struct stream *strm, unsigned int opt,
+smp_fetch_hdr_names(struct proxy *px, struct session *sess, struct stream *strm, unsigned int opt,
                     const struct arg *args, struct sample *smp, const char *kw, void *private)
 {
 	struct hdr_idx *idx;
@@ -10363,7 +10371,7 @@
  * headers are considered from the first one.
  */
 static int
-smp_fetch_hdr(struct proxy *px, struct stream *strm, unsigned int opt,
+smp_fetch_hdr(struct proxy *px, struct session *sess, struct stream *strm, unsigned int opt,
               const struct arg *args, struct sample *smp, const char *kw, void *private)
 {
 	struct hdr_idx *idx;
@@ -10420,7 +10428,7 @@
  * Accepts exactly 1 argument of type string.
  */
 static int
-smp_fetch_hdr_cnt(struct proxy *px, struct stream *strm, unsigned int opt,
+smp_fetch_hdr_cnt(struct proxy *px, struct session *sess, struct stream *strm, unsigned int opt,
                   const struct arg *args, struct sample *smp, const char *kw, void *private)
 {
 	struct hdr_idx *idx;
@@ -10457,10 +10465,10 @@
  * may or may not be appropriate for everything.
  */
 static int
-smp_fetch_hdr_val(struct proxy *px, struct stream *strm, unsigned int opt,
+smp_fetch_hdr_val(struct proxy *px, struct session *sess, struct stream *strm, unsigned int opt,
                   const struct arg *args, struct sample *smp, const char *kw, void *private)
 {
-	int ret = smp_fetch_hdr(px, strm, opt, args, smp, kw, private);
+	int ret = smp_fetch_hdr(px, sess, strm, opt, args, smp, kw, private);
 
 	if (ret > 0) {
 		smp->type = SMP_T_UINT;
@@ -10475,12 +10483,12 @@
  * It returns an IPv4 or IPv6 address.
  */
 static int
-smp_fetch_hdr_ip(struct proxy *px, struct stream *strm, unsigned int opt,
+smp_fetch_hdr_ip(struct proxy *px, struct session *sess, struct stream *strm, unsigned int opt,
                  const struct arg *args, struct sample *smp, const char *kw, void *private)
 {
 	int ret;
 
-	while ((ret = smp_fetch_hdr(px, strm, opt, args, smp, kw, private)) > 0) {
+	while ((ret = smp_fetch_hdr(px, sess, strm, opt, args, smp, kw, private)) > 0) {
 		if (url2ipv4((char *)smp->data.str.str, &smp->data.ipv4)) {
 			smp->type = SMP_T_IPV4;
 			break;
@@ -10507,7 +10515,7 @@
  * the first '/' after the possible hostname, and ends before the possible '?'.
  */
 static int
-smp_fetch_path(struct proxy *px, struct stream *strm, unsigned int opt,
+smp_fetch_path(struct proxy *px, struct session *sess, struct stream *strm, unsigned int opt,
                const struct arg *args, struct sample *smp, const char *kw, void *private)
 {
 	struct http_txn *txn;
@@ -10541,7 +10549,7 @@
  * The returned sample is of type string.
  */
 static int
-smp_fetch_base(struct proxy *px, struct stream *strm, unsigned int opt,
+smp_fetch_base(struct proxy *px, struct session *sess, struct stream *strm, unsigned int opt,
                const struct arg *args, struct sample *smp, const char *kw, void *private)
 {
 	struct http_txn *txn;
@@ -10554,7 +10562,7 @@
 	txn = strm->txn;
 	ctx.idx = 0;
 	if (!http_find_header2("Host", 4, txn->req.chn->buf->p, &txn->hdr_idx, &ctx) || !ctx.vlen)
-		return smp_fetch_path(px, strm, opt, args, smp, kw, private);
+		return smp_fetch_path(px, sess, strm, opt, args, smp, kw, private);
 
 	/* OK we have the header value in ctx.line+ctx.val for ctx.vlen bytes */
 	temp = get_trash_chunk();
@@ -10589,7 +10597,7 @@
  * high-traffic sites without having to store whole paths.
  */
 int
-smp_fetch_base32(struct proxy *px, struct stream *strm, unsigned int opt,
+smp_fetch_base32(struct proxy *px, struct session *sess, struct stream *strm, unsigned int opt,
                  const struct arg *args, struct sample *smp, const char *kw, void *private)
 {
 	struct http_txn *txn;
@@ -10638,17 +10646,16 @@
  * 8 bytes would still work.
  */
 static int
-smp_fetch_base32_src(struct proxy *px, struct stream *strm, unsigned int opt,
+smp_fetch_base32_src(struct proxy *px, struct session *sess, struct stream *strm, unsigned int opt,
                      const struct arg *args, struct sample *smp, const char *kw, void *private)
 {
 	struct chunk *temp;
-	struct session *sess = strm_sess(strm);
 	struct connection *cli_conn = objt_conn(sess->origin);
 
 	if (!cli_conn)
 		return 0;
 
-	if (!smp_fetch_base32(px, strm, opt, args, smp, kw, private))
+	if (!smp_fetch_base32(px, sess, strm, opt, args, smp, kw, private))
 		return 0;
 
 	temp = get_trash_chunk();
@@ -10678,7 +10685,7 @@
  * of type string carrying the whole query string.
  */
 static int
-smp_fetch_query(struct proxy *px, struct stream *strm, unsigned int opt,
+smp_fetch_query(struct proxy *px, struct session *sess, struct stream *strm, unsigned int opt,
                 const struct arg *args, struct sample *smp, const char *kw, void *private)
 {
 	struct http_txn *txn;
@@ -10704,7 +10711,7 @@
 }
 
 static int
-smp_fetch_proto_http(struct proxy *px, struct stream *strm, unsigned int opt,
+smp_fetch_proto_http(struct proxy *px, struct session *sess, struct stream *strm, unsigned int opt,
                      const struct arg *args, struct sample *smp, const char *kw, void *private)
 {
 	/* Note: hdr_idx.v cannot be NULL in this ACL because the ACL is tagged
@@ -10720,7 +10727,7 @@
 
 /* return a valid test if the current request is the first one on the connection */
 static int
-smp_fetch_http_first_req(struct proxy *px, struct stream *strm, unsigned int opt,
+smp_fetch_http_first_req(struct proxy *px, struct session *sess, struct stream *strm, unsigned int opt,
                          const struct arg *args, struct sample *smp, const char *kw, void *private)
 {
 	smp->type = SMP_T_BOOL;
@@ -10730,7 +10737,7 @@
 
 /* Accepts exactly 1 argument of type userlist */
 static int
-smp_fetch_http_auth(struct proxy *px, struct stream *strm, unsigned int opt,
+smp_fetch_http_auth(struct proxy *px, struct session *sess, struct stream *strm, unsigned int opt,
                     const struct arg *args, struct sample *smp, const char *kw, void *private)
 {
 
@@ -10749,7 +10756,7 @@
 
 /* Accepts exactly 1 argument of type userlist */
 static int
-smp_fetch_http_auth_grp(struct proxy *px, struct stream *strm, unsigned int opt,
+smp_fetch_http_auth_grp(struct proxy *px, struct session *sess, struct stream *strm, unsigned int opt,
                         const struct arg *args, struct sample *smp, const char *kw, void *private)
 {
 	if (!args || args->type != ARGT_USR)
@@ -10877,7 +10884,7 @@
  * the "capture" option in the configuration file
  */
 static int
-smp_fetch_capture_header_req(struct proxy *px, struct stream *strm, unsigned int opt,
+smp_fetch_capture_header_req(struct proxy *px, struct session *sess, struct stream *strm, unsigned int opt,
                              const struct arg *args, struct sample *smp, const char *kw, void *private)
 {
 	struct proxy *fe = strm_sess(strm)->fe;
@@ -10903,7 +10910,7 @@
  * the "capture" option in the configuration file
  */
 static int
-smp_fetch_capture_header_res(struct proxy *px, struct stream *strm, unsigned int opt,
+smp_fetch_capture_header_res(struct proxy *px, struct session *sess, struct stream *strm, unsigned int opt,
                              const struct arg *args, struct sample *smp, const char *kw, void *private)
 {
 	struct proxy *fe = strm_sess(strm)->fe;
@@ -10927,7 +10934,7 @@
 
 /* Extracts the METHOD in the HTTP request, the txn->uri should be filled before the call */
 static int
-smp_fetch_capture_req_method(struct proxy *px, struct stream *strm, unsigned int opt,
+smp_fetch_capture_req_method(struct proxy *px, struct session *sess, struct stream *strm, unsigned int opt,
                              const struct arg *args, struct sample *smp, const char *kw, void *private)
 {
 	struct chunk *temp;
@@ -10955,7 +10962,7 @@
 
 /* Extracts the path in the HTTP request, the txn->uri should be filled before the call  */
 static int
-smp_fetch_capture_req_uri(struct proxy *px, struct stream *strm, unsigned int opt,
+smp_fetch_capture_req_uri(struct proxy *px, struct session *sess, struct stream *strm, unsigned int opt,
                           const struct arg *args, struct sample *smp, const char *kw, void *private)
 {
 	struct chunk *temp;
@@ -10994,7 +11001,7 @@
  * as a string (either "HTTP/1.0" or "HTTP/1.1").
  */
 static int
-smp_fetch_capture_req_ver(struct proxy *px, struct stream *strm, unsigned int opt,
+smp_fetch_capture_req_ver(struct proxy *px, struct session *sess, struct stream *strm, unsigned int opt,
                           const struct arg *args, struct sample *smp, const char *kw, void *private)
 {
 	struct http_txn *txn = strm->txn;
@@ -11018,7 +11025,7 @@
  * as a string (either "HTTP/1.0" or "HTTP/1.1").
  */
 static int
-smp_fetch_capture_res_ver(struct proxy *px, struct stream *strm, unsigned int opt,
+smp_fetch_capture_res_ver(struct proxy *px, struct session *sess, struct stream *strm, unsigned int opt,
                           const struct arg *args, struct sample *smp, const char *kw, void *private)
 {
 	struct http_txn *txn = strm->txn;
@@ -11049,7 +11056,7 @@
  * The returned sample is of type CSTR. Can be used to parse cookies in other
  * files.
  */
-int smp_fetch_cookie(struct proxy *px, struct stream *strm, unsigned int opt,
+int smp_fetch_cookie(struct proxy *px, struct session *sess, struct stream *strm, unsigned int opt,
                      const struct arg *args, struct sample *smp, const char *kw, void *private)
 {
 	struct http_txn *txn;
@@ -11151,7 +11158,7 @@
  * type UINT. Accepts exactly 1 argument of type string.
  */
 static int
-smp_fetch_cookie_cnt(struct proxy *px, struct stream *strm, unsigned int opt,
+smp_fetch_cookie_cnt(struct proxy *px, struct session *sess, struct stream *strm, unsigned int opt,
                      const struct arg *args, struct sample *smp, const char *kw, void *private)
 {
 	struct http_txn *txn;
@@ -11221,10 +11228,10 @@
  * takes a mandatory argument of type string. It relies on smp_fetch_cookie().
  */
 static int
-smp_fetch_cookie_val(struct proxy *px, struct stream *strm, unsigned int opt,
+smp_fetch_cookie_val(struct proxy *px, struct session *sess, struct stream *strm, unsigned int opt,
                      const struct arg *args, struct sample *smp, const char *kw, void *private)
 {
-	int ret = smp_fetch_cookie(px, strm, opt, args, smp, kw, private);
+	int ret = smp_fetch_cookie(px, sess, strm, opt, args, smp, kw, private);
 
 	if (ret > 0) {
 		smp->type = SMP_T_UINT;
@@ -11326,7 +11333,7 @@
 }
 
 static int
-smp_fetch_url_param(struct proxy *px, struct stream *strm, unsigned int opt,
+smp_fetch_url_param(struct proxy *px, struct session *sess, struct stream *strm, unsigned int opt,
                     const struct arg *args, struct sample *smp, const char *kw, void *private)
 {
 	char delim = '?';
@@ -11358,10 +11365,10 @@
  * above).
  */
 static int
-smp_fetch_url_param_val(struct proxy *px, struct stream *strm, unsigned int opt,
+smp_fetch_url_param_val(struct proxy *px, struct session *sess, struct stream *strm, unsigned int opt,
                         const struct arg *args, struct sample *smp, const char *kw, void *private)
 {
-	int ret = smp_fetch_url_param(px, strm, opt, args, smp, kw, private);
+	int ret = smp_fetch_url_param(px, sess, strm, opt, args, smp, kw, private);
 
 	if (ret > 0) {
 		smp->type = SMP_T_UINT;
@@ -11382,7 +11389,7 @@
  * as well as the path
  */
 static int
-smp_fetch_url32(struct proxy *px, struct stream *strm, unsigned int opt,
+smp_fetch_url32(struct proxy *px, struct session *sess, struct stream *strm, unsigned int opt,
                 const struct arg *args, struct sample *smp, const char *kw, void *private)
 {
 	struct http_txn *txn;
@@ -11431,14 +11438,13 @@
  * 8 bytes would still work.
  */
 static int
-smp_fetch_url32_src(struct proxy *px, struct stream *strm, unsigned int opt,
+smp_fetch_url32_src(struct proxy *px, struct session *sess, struct stream *strm, unsigned int opt,
                     const struct arg *args, struct sample *smp, const char *kw, void *private)
 {
 	struct chunk *temp;
-	struct session *sess = strm_sess(strm);
 	struct connection *cli_conn = objt_conn(sess->origin);
 
-	if (!smp_fetch_url32(px, strm, opt, args, smp, kw, private))
+	if (!smp_fetch_url32(px, sess, strm, opt, args, smp, kw, private))
 		return 0;
 
 	temp = get_trash_chunk();