flags.authenticated is a session record