add on_auth and on_session callbacks

on_auth - you can accept connect by some data from url
on_session - you can decline connect by data from session