implement session for authentication