reintroduced session model and improved auth mechanism