Only redirect stderr after the session login. That lets errors get recorded on the server parent side, rather than being sent over a SSH connection.