reworked session/auth handling