basic authorization + verify_session (master controller)