correct - this is for the post-auth session and not the authentication phase