added auth+session management