add session-based auth to sockets