completed session based authentication