added session handling / auth