Authentication filter: change method to get session