minor refactors to authentication/sessions