some refactoring of Authenticate and SessionManagerImpl