Refactored session based authentication