change all handlers to session authentication