Change authentication scheme to based on Session