handle session with reauth