Session authentication works.