api auth and session management