rm session, add auth headers