Authorization @Path changed to Session