refactor of auth/session modules