sessionAuth required on production mode