call auth instead of sessions.auth, use conf to set session length
add test for sessions
fix session / user