auth. scheme with session for hapi