authentication works properly with sessions