add session routes and authentication