auth is ok.next is session