added session control, user auth