diff --git a/http/http_connection.hpp b/http/http_connection.hpp
index a0ab1ec..b169309 100644
--- a/http/http_connection.hpp
+++ b/http/http_connection.hpp
@@ -332,7 +332,7 @@
             if (thisReq.getHeaderValue(boost::beast::http::field::host).empty())
             {
                 res.result(boost::beast::http::status::bad_request);
-                completeRequest(res);
+                completeRequest();
                 return;
             }
         }
@@ -351,27 +351,25 @@
 
         if (res.completed)
         {
-            completeRequest(res);
+            completeRequest();
             return;
         }
 
         if (!crow::authorization::isOnAllowlist(req->url, req->method()) &&
             thisReq.session == nullptr)
         {
-            BMCWEB_LOG_WARNING << "Authentication failed";
+            BMCWEB_LOG_WARNING << "[AuthMiddleware] authorization failed";
             forward_unauthorized::sendUnauthorized(
                 req->url, req->getHeaderValue("User-Agent"),
                 req->getHeaderValue("Accept"), res);
-            completeRequest(res);
+            completeRequest();
             return;
         }
 
-        auto asyncResp = std::make_shared<bmcweb::AsyncResp>();
-        BMCWEB_LOG_DEBUG << "Setting completion handler for connection";
-        asyncResp->res.setCompleteRequestHandler(
-            [self(shared_from_this())](crow::Response& res) {
-                self->completeRequest(res);
-            });
+        res.setCompleteRequestHandler([self(shared_from_this())] {
+            boost::asio::post(self->adaptor.get_executor(),
+                              [self] { self->completeRequest(); });
+        });
 
         if (thisReq.isUpgrade() &&
             boost::iequals(
@@ -381,9 +379,10 @@
             handler->handleUpgrade(thisReq, res, std::move(adaptor));
             // delete lambda with self shared_ptr
             // to enable connection destruction
-            asyncResp->res.setCompleteRequestHandler(nullptr);
+            res.setCompleteRequestHandler(nullptr);
             return;
         }
+        auto asyncResp = std::make_shared<bmcweb::AsyncResp>(res);
         handler->handle(thisReq, asyncResp);
     }
 
@@ -407,7 +406,8 @@
                                          boost::asio::ip::tcp::socket>>)
         {
             adaptor.next_layer().close();
-            if (sessionIsFromTransport && userSession != nullptr)
+#ifdef BMCWEB_ENABLE_MUTUAL_TLS_AUTHENTICATION
+            if (userSession != nullptr)
             {
                 BMCWEB_LOG_DEBUG
                     << this
@@ -415,6 +415,7 @@
                 persistent_data::SessionStore::getInstance().removeSession(
                     userSession);
             }
+#endif // BMCWEB_ENABLE_MUTUAL_TLS_AUTHENTICATION
         }
         else
         {
@@ -422,13 +423,12 @@
         }
     }
 
-    void completeRequest(crow::Response& thisRes)
+    void completeRequest()
     {
         if (!req)
         {
             return;
         }
-        res = std::move(thisRes);
         BMCWEB_LOG_INFO << "Response: " << this << ' ' << req->url << ' '
                         << res.resultInt() << " keepalive=" << req->keepAlive();
 
@@ -481,7 +481,7 @@
 
         res.keepAlive(req->keepAlive());
 
-        doWrite(res);
+        doWrite();
 
         // delete lambda with self shared_ptr
         // to enable connection destruction
@@ -655,7 +655,7 @@
             });
     }
 
-    void doWrite(crow::Response& thisRes)
+    void doWrite()
     {
         bool loggedIn = req && req->session;
         if (loggedIn)
@@ -667,8 +667,8 @@
             startDeadline(loggedOutAttempts);
         }
         BMCWEB_LOG_DEBUG << this << " doWrite";
-        thisRes.preparePayload();
-        serializer.emplace(*thisRes.stringResponse);
+        res.preparePayload();
+        serializer.emplace(*res.stringResponse);
         boost::beast::http::async_write(
             adaptor, *serializer,
             [this,