fixed auth session