add an 'unauthorized' response handler, clean up sessionAuth policy a bit