sessions now locking unauthed users out