session auth for tasty and some for REST