implemented authentication by session
authentication by session