Minor work around authentication
- fixed the authentication call to use session key as check
- made 500 error message more formal
- added tests around authentication