fixed session auth so it is persistent through the session, again gives 200 but does not end on page of template