add auth and session mgmt and decorators