using real sessions to make pusher authenticator work for real