need to configure SessionAuthenticationModule next