some changes

- add role check into auth
- move session into context
- add several checks