auth updateSession update by _id support
fix http to pass frontend test