/api/auth/session/ ↑