session authentication using ENV pw