session auth tweaks