Auth-session bug