finished authentication, need work on session