wip: session management and auth