fixed autho

not using .NET authentication. Relying on session