more users/auth/session functionality