add 2fa and session