Changed to session authentication