finished the first instance of broken auth and sess mgmt