add support to login with username. add create session route to /login