bugfix auth session