adding sessions to the authentication pattern