return impersonated session not authz session