add session authentication