client side session and authorization