User authentication and session management