introducing state for session and better support of local creds