refactor to user session.auth and rename 'username' argument