added stateless authentication option (using session only)