Sessions spec and authentication