speeding through implementing session,auth and acl -- will revisit the code and clean-up later