authentication and session fixed