session auth sending x-remote-user