Minimal session-based authentication