creating sessions is the job of Auth