A session based auth scheme for hapi