Session based authorization is now working.