make the authorized session a proper class var