refs: session authorize , done