corr: jsload with session auth