feat(auth): sync session across browser tabs