Standardize on array()
Session is auth, so we can later pull out into auth[] and email[]