some session stuff for authorizing the session (user)