update back-end:
*create session
*page authorization