basic sessions and session based authentication