modify session authorization