         ##
         ## 
         ##
-        authorize: (token, fn)->
-            
-            sid = token.substr 40				
-            
-            #console.log 'session authorize session %s', sid
-            
-            if (sess = @_registry.get sid)
+        authorize: (token, fn)->            				
+            
+            if token && (sess = @_registry?.get (sid = token.substr 40))
                 
                 #console.log 'found session', sess, sess.public.user?.login
 

    ##
    ## 
    ##
    class HttpSessions extends floyd.Context
        
        configure: (config)->
        
            @_hiddenKeys.push 'Registry', 'Session'
            @_TOKENS = config.tokens
  
            super new floyd.Config
            
                data:

            
            @logger.debug 'session authenticate identity %s', identity.id
            
            super identity, (err)=>
                return fn() if !err ## successfully authenticated
                
                identity.token (err, token)=>
                    if err || !token
                        @logger.warning 'session authenticate NO TOKEN', identity.id

                        return fn(err || new Error 'session authenticate NO TOKEN') 
                
                    sid = token.substr 40				
                    
                    @logger.fine 'session authenticate session %s', sid

                    @_load sid, (err, sess)=>
                        return fn(err) if err
                    
                        @logger.finer 'session authenticate hash %s', token.substr 0, 39
                    
                        if token is sess.token
                        
                            @logger.debug 'session authenticate SUCCESS', identity.id 
                        
                            fn()
                        
                        else
                            @logger.debug 'session authenticate FAILURE', identity.id 
                        
                            fn new Error 'session authenticate FAILURE'
                            
        
