set up session auth
finish up auth