Secure session-based authentication