session authorization moved to application controller