authentication and sessions complete