application and api is now session secured