Hi Carrie,
Let's do the following test, remove everything except the confidential variable and see if that works.
To ensure that we don't break the XML please use the builder to do that.
Also, please remember that the session variable name is case sensitive and check the docuemntation to ensure that the value type, source name asre used correctly.