session: redundant since session is auth_admin()