auth: use /session to sign in