progress on session management and REST authentication