doing authentication by session