bugfix session auth