changed auth GET to POST and fixed route
modular session handling, cleaned up