finished backend auth and sessions