removed the call to getAuthenticatedSession