beginning of authentication and session management