fixed bug in Session Auth