Design Issues In Session Layer Authentication