fix session and auth