Maybe /auth instead of /session?