add session class and update auth