authorization and session management pt 2