Fix authentication decorator and make authentication check session headers