refactor authentication and authsession code