(most) all functions now take SessionAuth in addition to PasswordAuth