adding session user control + basic authorization/authentication