added session authentication