More progress with authentication and session handling