session auth handling strategy; first cut