Refactoring auth service, auth logic gets real user. Session manipulation transfered to logic layer.