using session resume on auth