add sessions and authentication