session: accept valid auth credentials