authentications and session working