added session authorizer and tests