session
initializing
validate
secure
protection
check session granted
challenge