modularized the session management code into authorization.php