session authentication now using callbacks