starting sessions
finished user side of auth