slightly working session auth