part of session and authorization