FIXED a bug about session auth