some changes

- add role check into auth
- move session into context
- add several checks
Merge branch 'master' into tests