btw, isn't the session management also set up when configuring the backend auth part? or is it a separate step?