if authentication with the session fails try authenticating with hmac