fixed session authentication