fixed session auth