Rewrote back+front code so that SessionAuthentication is used in API