added basic auth with sessions